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This paper presents a multi-stage, multi-photon quantum key distribution protocol based on 
the double-lock cryptography. It exploits the asymmetry in the detection strategies between the 
legitimate users and the eavesdropper. The security analysis of the protocol is presented with 
coherent states under the intercept-resend attack, the photon number splitting attack, and the 
man-in-the-middle attack. It is found that the mean photon number can be much larger than 
one. This complements the recent interest in multi-photon quantum communication protocols that 
require a pre-shared key between the legitimate users. 
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I. INTRODUCTION 

The security of quantum cryptography is based on the 
inherent uncertainty in quantum phenomena and it is the 
only known means of providing unconditionally secure 
communication [1, 2]. Almost all contemporary practical 
QKD implementations are derived from the BB84 pro¬ 
tocol [3], a QKD protocol first proposed in 1984 and 
commercially implemented for limited market applica¬ 
tions in the early 2000s. A major limitation of BB84 
is that it requires no more than a single photon per time 
slot. Practically one relies on optical beams so weak that 
they generate less than one photon on average per time 
slot. In fact, BB84 and its decoy-state derivative are 
provably secure and optimal only when the mean photon 
number is about 0.5 [4-10]. 

In this paper, we introduce a new multi-photon QKD 
protocol, first proposed in [11], and demonstrate its 
security against the intercept-resend (IR) attack, the 
photon-number-splitting (PNS) attack, and the man-in- 
the-middle (MIM) attack. It is found that the mean 
photon number of the coherent pulses can generally be 
greater than 1. The protocol thus has the potential to 
allow QKD using detectors that may not be very effi¬ 
cient. It should be noted that multi-photon QKD proto¬ 
cols have also been studied under the category of continu¬ 
ous variable (CV) QKD protocols [12-14]. Nevertheless, 
CV-QKD requires homodyne or heterodyne detections, 
which are generally more complicated than photon count¬ 
ing used in discrete variable QKD protocols, as well as 
more sensitive to the noise in the quantum channel. 

The principle behind the multi-photon, multi-stage 
QKD protocol to be discussed below is essentially the 
same as that of the classical double-lock cryptography. 
Security is given by the asymmetry in the detection 
strategies between the legitimate users and the eaves¬ 
dropper, which is provided by the advantage creation 
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akin to that utilized in the optimal quantum receiver in 
the YOO (or arj) protocol [15] and the keyed communi¬ 
cation in quantum noise (KCQ) method [16]. A main 
difference is that the current protocol does not require a 
pre-shared key as in YOO or KCQ. 

In the following, we provide a detailed analysis on the 
security of the simplest form of the multi-stage protocol, 
the three-stage protocol. The dependence of the error 
probabilities in terms of the number of photons utilized 
in the channel will be studied. 


II. THREE-STAGE QUANTUM 
CRYPTOGRAPHY 

We now discuss the operations of the multi-photon tol¬ 
erant quantum protocols in terms of transferring state X 
from Alice to Bob. The state X is one of two orthogonal 
states, designated as |0) and |1). The orthogonal states 
of X represent 0 and 1 by prior mutual agreement of the 
parties and they are the cryptographic key being trans¬ 
mitted over the public channel. Alice and Bob apply 
secret transformations Ua and Ub which are commuta¬ 
tive, i.e., UaUb = UbUa, on the quantum state before 
it is transmitted in the channel. 

The steps of the protocol are described as follows: 

1. Alice applies a unitary transformation Ua on infor¬ 
mation X and sends it to Bob. 

2. Bob randomly chooses to retain the received signal 
Ua{X) for authentication or to send it back to Alice 
with Ub applied. 

3. Alice randomly chooses to retain the received signal 
UbUa{X) for authentication or to send it back to 
Bob with Ua (complex conjugate transpose of Ua) 
applied. 

4. Bob applies U^ on u\UbUa{X) = Ub{X) to get 
the information X. 
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FIG. 1; Schematic diagram of the three-stage protocol. The 
data X is encrypted by the commutative transformations Ua 
and Ub during the transmission in the quantum channel. 


5. After receiving all the pulses, Bob announces pub¬ 
licly which pulses he has measured. Alice then dis¬ 
cards those pulses that Bob did not measure. If the 
bit rate of the key is too low, the key is abandoned. 

6. Bob tells Alice the qubits he chose for authentica¬ 
tion. Alice reveals to him the corresponding trans¬ 
formations and X she applied for those qubits. The 
transformations are used to estimate the possibility 
of a man-in-the-middle attack. The authentication 
can likewise be performed using the pulses retained 
by Alice. Then Alice reveals to Bob some portion 
of the exchanged information X to check the error 
rate. They accept the rest of the key if the error 
rate of the key and the transformations are below 
certain thresholds. 

7. Alice and Bob finally perform post-processing (er¬ 
ror correction and privacy amplification) as usual 
to minimize Eve’s information. 

The schematic of the three-stage protocol is shown in 
Fig. 1. It should be noted that the unitaries Ua and 
Ub can be some general transformations that can mask 
the original state X. The parameters in Ua and Ub can 
be from a discrete or a continuous set. In the following, 
we consider the encoding of the qubit using the polariza¬ 
tion of the photons in a coherent state. In this way, the 
data X is represented by the polarization angle 6x and 
the unitary transformations Ua and Ub are realized as 
polarization rotations through angles 9a and 9b respec¬ 
tively. Note that since Ua and Ub are required to be 
commutative, the polarization rotations are constrained 
on a great circle of the Poincare sphere. 

It is remarked that the use of many polarization angles 
to increase the robustness of QKD protocols has also been 
explored in [17, 18]. In addition, the scheme described 
here can in principle be applied to other degrees of free¬ 
dom of the photons just like the YOO protocol [19, 20] 
and the state X can be extended to multi-alphabet qu- 
dit systems. 


III. DETAILED ANALYSIS OF THE 
THREE-STAGE PROTOCOL 

The three-stage protocol can be viewed as a quantum 
double-lock encryption, with the unitary transformations 
(polarization rotations in this case) Ua and Ub acting as 
the locks. Therefore, the security of the three-stage pro¬ 
tocol relies on (1) the ability of the transformations in 
protecting the transmitted bit value, and (2) the premise 
that Alice and Bob are certain that they are the ones who 
really applied the locks during the information transmis¬ 
sion. The man-in-the-middle (MIM) attack by an in¬ 
truder Eve exploits the second condition. We shall treat 
the two situations in detail in the following. 

The main idea of the three-stage protocol is that, to 
obtain the key X, Bob only needs to distinguish between 
two possible orthogonal polarization states, e.g., horizon¬ 
tal or vertical. On the other hand, in order to obtain use¬ 
ful information, an eavesdropper Eve needs to determine 
the arbitrary unknown polarization angles (j)i of the quan¬ 
tum state transmitting in the quantum channel. The ac¬ 
curacy of her measurement depends on the number of 
photons she can access from the channel. 

The amount of polarization rotations that both sides 
(Alice and Bob) select to give to the information bits is 
an arbitrary and independent value which varies from 0 
to 180 degrees. It should be noted that practically one 
must also take into account the difficulties with maintain¬ 
ing stability and fidelity in the presence of noise. In the 
following analysis, we will ignore such requirements and 
assume that Alice and Bob can maintain perfect align¬ 
ment in their basis for simplicity. 


A. Intercept-Resend (IR) and Photon Number 
Splitting (PNS) Attacks 

We first consider the situation that the communication 
between Alice and Bob is authenticated, i.e., Alice knows 
that the information she sends out passes through Bob 
in the intermediate step and vice versa. Under this as¬ 
sumption, Eve can launch intercept-resend (IR) attacks, 
or more importantly, the photon-number-splitting (PNS) 
attack. 

The main difference between IR and PNS is that, in IR 
all the photons are being taken out by Eve and she then 
resends any photon state to Bob. On the other hand, 
under PNS attack, the number of photons Bob receives 
is less than that in the original pulse. Such a loss of 
photons practically could be due to the channel loss, but 
in the analysis one has to attribute it to the action of the 
intruder. 

If we further restrict ourselves to the situation of inco¬ 
herent attacks, Eve is required to perform measurements 
before the classical postprocessing. Therefore, under the 
IR attack, the polarization states of the pulses resent by 
Eve usually are different from that she intercepts because 
of the measurement process, with the difference depend- 
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ing on the number of photons she receives. We can es¬ 
timate the security against the IR attack by assuming 
the polarization states of the resent pulses are the same 
as those before the pulses are intercepted by Eve. This 
is an overestimation of the ability of Eve. Nevertheless, 
it enables us to analyze IR and PNS attacks using the 
same formalism. In addition, Eve’s information Iea and 
Ieb become identical, where Iea = maxEveI^(E : A) is 
the maximal mutual information between Eve and Alice 
with a similar expression for I{E : B). 

For the IR and PNS attacks on the three-stage pro¬ 
tocol, Eve only needs to measure the polarization angles 
of any two stages (say the first and the second stages). 
Then she can extract the bit value by orienting her mea¬ 
surement device in the third stage according the angles 
of the first and second stages. 

More definitely, suppose the polarization angles of the 
three stages of the protocol are denoted by (j)i = Ox+ 0 a, 
(t >2 = Ox + Oa + Ob and (/>3 = + Ob, where Ox is the 

information bit angle (0 or 7r/2), and Oa and Ob are the 
angles associated with Alice’s and Bob’s unitary trans¬ 
formations. Then the corresponding angles estimated by 
Eve for the first two stages are written as (j)i = Ox + Oa 
and 02 = Ox + Oa + Ob- As a result, Ob = (j )2 — 01- 
In order for Eve to obtain useful information, she re¬ 
quires that the error in determining Ob should not be 
too large. Since Ox is a binary random number of either 
0 or 7r/2, Eve will determine the bit value erroneously if 


Ob — Ob 



(<(’2 


<(’l) 


> 7r/4. The error 


probability of Eve is then given by 


Pe{Ni,N2)= [ 001002 001002 P(01 )Pl (01101, A^l) 
Js 

XP(02)P2(02|02,A^2), (1) 


where = l/27r is the prior distribution of Alice’s 

(Bob’s) rotation angle and Pi(0i|0i, Ni) is the conditional 
probability of determining 0^ given the angle 0i and the 
mean photon number Ni that is accessible by Eve. The 
integration domain S corresponds to the region where 
the condition 


2 — 01) — (02 — 0i) > 7r/4 is satisfied. 


The mutual information I{E : A) is given hy I{E : A) = 
1 — h{Pf.), where h{x) is the binary entropy function. 

Consider a three-stage protocol using coherent states 
of mean photon number N. First of all, Alice should 
randomize the phases of the coherent states to avoid Eve 
exploiting the phase information [21]. In this case, the 
quantum state is described by a density matrix with pho¬ 
ton number following the Poisson distribution with pa¬ 
rameter N. 

To obtain a bound of the secure key rate, one has to 
estimate Eve’s maximal information (see Section III C be¬ 
low). This involves an optimal measurement strategy to 
obtain the conditional probability Pi{(j)i\(j)i, Ni). Bagan 
et al. [22] gave a detailed comparison of the estimation 
of the polarization state of a finite number of photons 
using the collective and local measurements. Instead of 


an optimal polarization measurement, in the following 
we consider a simple strategy that Eve performs polar¬ 
ization analysis with a fixed basis, denoted as horizontal 
and vertical, that is the same as Alice’s and Bob’s ba¬ 
sis. Such a fixed basis (or tomographic) measurement 
is generally not optimal. Nevertheless, we additionally 
assume that Eve can determine the polarization angle 
correctly using a single basis only, instead of two bases 
that are required for the polarization states on a circle of 
the Poincare sphere. This is accomplished by attribut¬ 
ing Eve’s measured polarization in the correct quadrant 
as the original polarization in the numerical calculations 
below. This procedure effectively doubles the number of 
photons available to Eve for the estimation, and the fi¬ 
delity obtained is generally even better than that using 
optimal collective measurements (see Fig. 1 of [22]). 

With the measurement strategy mentioned above, the 
probability distributions of Eve’s numbers of horizontal 
and vertical photons in the three stages are given by 


Pi ipH,i, 10i 5 Ali) 

e 


(iVj cos^ [Ni sin^ 0*)^”'^’’ 


1 — e 


-Ni 




( 2 ) 


for i = 1,2,3, where Ni is the mean number of photons 
in stage i that is accessible by Eve. Here the continuous 
variable (pi in Eq. (1) is replaced by the discrete variables 
nH,i and nv.i- Then 0i can be estimated from the num¬ 
bers of photons detected in the vertical port (ny,i) and 
the horizontal port {nuy) of the polarization analyzer by 
tan^ 0i = nv.iInH.i- Note that in Eq. (2), nny and nyy 
cannot be zero simultaneously, for this gives no informa¬ 
tion to Eve about the angle pi. Also we assume Ni is 
known to Eve. 

For the PNS attack. Eve’s best strategy without caus¬ 
ing errors to Bob’s received bits will be to take A^i = 
N 2 ^ N/2 if Bob did not monitor the photon statistics. 
Nevertheless, we require that Bob monitors the number 
of incoming photons so that Eve cannot probe Alice and 
his devices with very bright pulses. For the IR attack, 
we can consider Ni = N 2 N. This corresponds to the 
optimal situation for Eve when the channel is assumed to 
be lossless. For a lossy channel with transmittance t, we 
consider Ni = N and N 2 = tN for IR and Ni = {l—t)N 
and N 2 = (1 — t)tN for PNS. Figure 2 gives the plots 
of Pe as a function of the mean photon number N. It 
is seen in Fig. 2 that even at the mean photon number 
N = 10, there is considerable error in Eve’s estimated 
values of the true bit values. 

As mentioned previously, Alice and Bob need to mon¬ 
itor the number of incoming photons to avoid Eve from 
injecting a very bright beam to probe their encoding de¬ 
vices. The presence of Eve is revealed if Alice and Bob 
also check the photon number distribution and detect any 
loss or change of the distribution. Eve could compensate 
the photon loss in the channel by injecting photons of 
arbitrary polarizations or at the angles 0i, as in the IR 
attack. Nevertheless, this introduces extra error in her 
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(a) (b) 

FIG. 2: Plots of (a) the IR and (b) the PNS error probabilities Ps{Ni, N 2 ) of Eve as functions of the mean number of photons 
N (see the text for detail). 


determination of Ox as well as error in Bob’s bits. In 
addition, the IR attack in fact induces errors to the bit 
values obtained by Bob. The estimation of the rotation 
angle error is addressed by the authentication process 
which specifically handles the man-in-the-middle attack 
in the next section. 


B. Authentication 

The three-stage protocol can be compromised entirely 
if Eve launches the man-in-middle (MIM) attack as de¬ 
picted in Fig. 3. Here Eve impersonates Bob to extract 
the true bit value perfectly. She also impersonates Alice 
to send the bit angle Ox together with the unperturbed 


Messaged 



FIG. 3: Schematic diagram of the three-stage protocol under 
the man-in-the-middle (MIM) attack. Eve impersonates Alice 
and Bob simultaneously. To Alice, Eve impersonates Bob 
and operates the three-stage protocol by applying her own 
rotation angle 6b, which could be any angle or the one that 
she derives from the photons coming from Bob, in the second 
stage. Likewise she can apply the angle (j)i to the photons 
sending to Bob in the first stage to minimize the chance of 
Bob catching her. 


angle Ob back to Bob, so that Bob receives the bit with¬ 
out error and hence cannot catch Eve. In such an MIM 
attack. Eve totally separates the quantum communica¬ 
tion between Alice and Bob. Therefore the attack could 
be revealed if authentications are made by Alice and Bob 
to guarantee the locks are legitimate, i.e., they are the 
true users who applied the rotation angles on the pulses 
they received in the three stages. 

In principle, authentication can be performed perfectly 
if Alice and Bob could retain the photons in steps 2 
and 3 of the protocol above until the end of the key ex¬ 
change, which can be accomplished by using quantum 
memories [23, 24] or slow light technologies [25]. More 
practically they need to perform measurements to deter¬ 
mine the parameters of the transformations during the 
key exchange. At the end of the key exchange, they 
check their measured values against the true values (step 
6). It should be noted that we assume Alice and Bob are 
authenticated for exchanging classical information on a 
public channel. This will rule out the chance that Eve is 
also in the middle when Alice and Bob try to compare 
the measurements. 

We consider that the transmittance of the quantum 
channel is t. If Alice sends pulses with a mean photon 
number of N, Bob expects to receive pulses with mean 
photon number tN in the first stage and t^N in the third 
stage, and Alice expects to receive pulses with mean pho¬ 
ton number t^N in the second stage. Therefore, for the 
MIM attack. Eve can extract a mean photon number of 
(1 — t^)N to obtain the estimate (f>i and a mean photon 
number of t{l — t'^)N to obtain the estimate Ob- Eve 
then use these two angles to impersonate Alice and Bob 
simultaneously. If Bob uses the pulse for authentication 
instead of the normal three-stage, the angle (pi he mea¬ 
sures conditioned on (pi will have a distribution given by 
Pi{pi\pi,tN)Pi{(pi\(pi,{l — t‘^)N). Here (pi is announced 
to Bob by Alice at the end of the protocol. Using this 
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Mean photon number N 


FIG. 4: Bob’s error probabilities in the estimation of dx for the normal three-stage operation blue lines) and 

under the MIM attack red lines) at different values of the channel transmittance t. The green lines denote the 

differences between the two error probabilities. 


angle, Bob can guess 9x with an error probability of be 


jAuth, MIM 


{t,N) = 


d(j>i d(j>i d(j)2 d(j)2 


'|0l—0l|>'n’/4 


On the other hand, in the normal operation when the 
MIM attack is not present, Bob’s error probability is in¬ 
stead given by 


pAuth, norm^^^ 


'|0i-0i|>7r/4 


Pi(^i|(/)i,tA^)P((/)i). (4) 


It is remarked that Eqs. (3) and (4) manifest that fact 
that, like Eve, Bob and Alice cannot estimate the polar¬ 
ization angles with certainty in the middle of the three- 
stage protocol because the photons are not in orthogonal 
states. 




lAuth, norm 


it,N) 


TT (1 — e 

ir/4 oo 


/•ir/2 oc 


+ / ^ Pi(0,ny|^i,tiV)d())i 

•’'o nv = l 


etN/2 


gtN _ I 


( 5 ) 


where In{x) is the modified Bessel function of the first 
kind and Ln{x) is the modified Struve function. 

It is noted in Fig. 4 that at small N the error probabil¬ 
ities tend to the constant values p^uth, norm 2“^ — 7r“^ 
and 0.5 whereas both probabilities tend to 

zero at large N. When the transmittance decreases, the 
two error probabilities converge to each other at a smaller 
N. In addition, the difference p^uth. mim _ pAuth, norm 

approaches an asymptotic form when t > 0, which is 
non-negligibly greater than zero for Af < 4. 


C. Secure Key Rate and Rate Efficiency 


Numerical simulations were performed using the mea¬ 
surement scheme described in the last section. Figure 4 
shows the two error probabilities as functions of the mean 
photon number N for different values of the transmit¬ 
tance t. In addition, p^uth, norm -g analytically to 


With error correction and privacy amplification, the 
expression for the secret key rate extractable using one¬ 
way classical postprocessing is [2] 

K = R[I{A:B)-mmilEA,lEB)], (6) 
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where R is the raw key rate, I {A : B) is the mutual 
information between Alice and Bob, and Iea and Ieb 
are Eve’s information about the raw key of Alice and 
Bob respectively. We consider the case when H{A) = 
H{B) = 1 and H{A\B) = H{B\A) = h{Q), where h{Q) 
is the binary entropy function and Q is the quantum 
bit error rate (QBER). For the three-stage protocol, the 
raw key rate is given by the total bit that Bob measured 
minus the bits for authentication. 

Assuming the error correction is carried out perfectly 
and using a very conservative estimate for the PNS/IR 
attack mentioned in Section III A with mutual informa¬ 
tion I{E : A) = 1 — h {Pe{N,tN)), the security key rate 
then becomes 


D. Ampliflcation Attack 

So far we have only focused on the situation where Eve 
makes direct measurement using the photons that she 
siphons off from the quantum channel. Generally she can 
do more with her photons. An important class of attacks 
is by amplifying the quantum states that she extracts 
from the channel. This kind of attack is linked to the 
foundation of the three-stage protocol, that is whether 
she can find out the angles 9a and 9b-, which are open 
to her eavesdropping, with high precision. In fact, the 
purpose of using finite number of photons in the channel 
is to limit Eve’s precision of measurement. 


K = R[{l-f)h{Pe{N,tN))-h{Q)], (7) 


where / is the fraction of the MIM attacks launched by 
Eve, which is estimated by the ratio of the measured au¬ 
thentication error probability difference and the expected 
measured authentication error probability difference, i.e., 


^Auth, measured_ ^Auth, 

/ - pAuth. _ pAuth, 


( 8 ) 


The threshold for the QBER is then determined by the 
condition AT > 0 for some given / < 1 and N. 

A potentially signihcant drawback of the three-stage 
protocol compared to other QKD protocols is that it re¬ 
quires multiple quantum communications between Alice 
and Bob, effectively increases the photon loss of the chan¬ 
nel. On the other hand, the multiple-photon resilient na¬ 
ture of the protocol allows a larger mean photon number 
to start with. As an estimate, we consider the ratio of 
the raw bit rates between the three stage protocol and 
the weak-coherent state BB84 with mean photon number 
0.5. The ratio is given by 


1 _ eAft(20 
1 _ g-0.5i(0 ’ 


(9) 


where the transmittance t is given as a function of dis¬ 
tance by t{l) = For optical fiber at the wave¬ 

length 1550 nm, a = 0.2 dB/km. The three-stage proto¬ 
col will have advantage over a one-stage protocol if A > 1. 
This gives 


A) 

It is emphasized that the choice of N depends on the 
security level described in the previous sections. From 
the previous analysis, it is seen that the MIM attack puts 
a more stringent condition to N than the PNS/IR attack. 
It is estimated that for up to a distance of 20 km with 
N = 3, the three-stage protocol could be advantageous 
over the decoy state BB84. 


It is well known that the amplification of a quantum 
state must also accompany with the amplification of the 
noise [26]. For the implementation with coherent states 
discussed in this paper. Eve does not gain anything by 
amplifying the signal. Even with the use of squeezed 
states, Fock states or entangled states to resend pulses 
to Bob and Alice, the intensity check by Alice and Bob 
will introduce vacuum noise to Eve’s probes, and Eve’s 
information gain may only be modest. 

On the other hand, it is recently shown that noiseless 
amplification of a quantum state is possible if a perfect 
guarantee of success is not required, unlike the usual de¬ 
terministic linear amplification mentioned above [27, 28] . 
Experiments of amplifying coherent states noiselessly 
have already been demonstrated [29, 30]. This appar¬ 
ently imposes a significant drawback to the three-stage 
protocol. Nevertheless, it should be noted that the prob¬ 
abilistic nature of the amplification means that Eve’s bit 
rate will further decrease. More importantly, the imple¬ 
mentations of the amplification of coherent states operate 
with high fidelity only when the mean photon number af¬ 
ter the gain is around unity [29, 30]. The amplification 
attack works well essentially for very weak coherent states 
but not for the regime of iV > 1 that we consider in our 
protocol. The distortion of the quantum states at larger 
N introduces noise to the determination of the polariza¬ 
tion. Further work is needed to quantify the effects of 
the amplihcation attack to the security of the protocol. 

Another issue related to the amplification attack on 
the three-stage protocol is that, in the actual implemen¬ 
tation, the polarization rotations 9a and 9b nevertheless 
have to be confined to a finite set because of the noise and 
stability of the experimental setup. Such limitation may 
open up the unambiguous state discrimination (USD) at¬ 
tack [31, 32]. Fortunately, the polarization rotations are 
local information that is secret to Alice and Bob inde¬ 
pendently; they can change their sets of the rotations 
frequently without disclosing their actions. This results 
in an extremely large set of the polarization rotations 
and effectively mitigates the threat of the USD attack, 
which requires that the number of photons needed must 
be greater than or equal to the number of polarization 
states in the middle of the three-stage protocol. 
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IV. CONCLUSION 

This paper gave a detailed security analysis to a new 
form of quantum key distribution protocol, the three- 
stage multi-photon quantum cryptography system, us¬ 
ing coherent states to encode qubits. In particular, we 
showed that the three-stage protocol is resilient to the 
photon number splitting attack, the intercept-resend at¬ 
tack, and the man-in-the-middle attack with the error 
probabilities calculated as functions of the mean num¬ 
ber of photons in the channel. We have obtained the 
secure key rate in terms of the error probabilities under 
the attacks considered. Importantly, we found that the 
mean photon number of the coherent states can practi¬ 
cally be larger than I, in contrast to most current QKD 
protocols in which weak coherent pulses (mean photon 
number ~ 0.1 for BB84 to 0.6 for decoy-BB84) are con¬ 
sidered. The multi-photon multi-stage scheme presented 


does not require pre-sharing of a key between the legiti¬ 
mate users like the YOO protocol. Hence it can be used to 
complement such multi-photon quantum communication 
protocols. 

We have also discussed the amplification and unam¬ 
biguous state discrimination attacks and argued that 
such attacks do not impose significant threat to our pro¬ 
tocol. Further study on this issue will be pursued in 
future to quantify the actual effect of the amplification 
attack using the analytic tool for the optimal coherent 
state ampliher [33]. 
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